CVE-2021-38406
Published: 17 September 2021
Summary
CVE-2021-38406 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Deltaww Dopsoft. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
Delta Electronic DOPSoft 2 versions 2.00.07 and prior contain a vulnerability in which the software lacks proper validation of user-supplied data when parsing specific project files. This produces multiple out-of-bounds write instances tracked under CWE-787.
An unauthenticated local attacker can supply a crafted project file that, once opened by a user, allows arbitrary code execution in the context of the current process. The attack vector requires user interaction but no privileges and yields high impact to confidentiality, integrity, and availability.
CISA has issued ICS advisory icsa-21-252-02 on the issue and lists the vulnerability in its known exploited vulnerabilities catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-24858
Vulnerability details
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of…
more
the current process.
- CWE(s)
- KEV Date Added
- 25 August 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied data in project files, eliminating the root cause of the out-of-bounds writes that enable code execution.
Enforces memory protections that can block or contain the out-of-bounds write primitives resulting from malformed DOPSoft project files.
Limits privileges of the process that opens untrusted project files, reducing the impact of successful arbitrary code execution.